An audit record describes an event, such as logging in to a system or
writing to a file. The record is composed of tokens, which are sets of audit
data. By using the zonename token, you can configure Solaris
auditing to identify audit events by zone. Use of the zonename token
allows you to produce the following information:

Audit records that are marked with the name of the zone that
generated the record

An audit log for a specific zone that the global administrator
can make available to the zone administrator

Configuring Audit in the Global Zone

Solaris audit trails are configured in the global zone. Audit policy
is set in the global zone and applies to processes in all zones. The audit
records can be marked with the name of the zone in which the event occurred.
To include zone names in audit records, you must edit the /etc/security/audit_startup file before you install any non-global zones. The zone name selection
is case-sensitive.

To configure auditing in the global zone to include all zone audit records,
add this line to the /etc/security/audit_startup file:

/usr/sbin/auditconfig -setpolicy +zonename

As the global administrator in the global zone, execute the auditconfig utility:

global# auditconfig -setpolicy +zonename

For additional information, see the audit_startup(1M) and auditconfig(1M) man pages and “Configuring Audit Files (Task
Map)” in System Administration Guide: Security Services.

Configuring User Audit Characteristics in
a Non-Global Zone

When a non-global zone is installed, the audit_control file
and the audit_user file in the global zone are copied to
the zone's /etc/security directory. These files might
require modification to reflect the zone's audit needs.

For example, each zone can be configured to audit some users differently
from others. To apply different per-user preselection criteria, both the audit_control and the audit_user files must
be edited. The audit_user file in the non-global zone might
also require revisions to reflect the user base for the zone if necessary.
Because each zone can be configured differently with regard to auditing users,
it is possible for the audit_user file to be empty.

Providing Audit Records for a Specific Non-Global
Zone

By including the zonename token as described in Configuring Audit in the Global Zone, Solaris
audit records can be categorized by zone. Records from different zones can
then be collected by using the auditreduce command to create
logs for a specific zone.